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Abstract  -  This  paper  presents  results  of  target  location 
specific  direct  injection  on  a  8051-based  microcontroller  in  a 
development  board  versus  a  custom  test  board.  Three  target 
locations  showed  no  failure  in  both  environments.  Using  the 
custom  board,  an  effect  was  found  in  a  target  location  which 
was  not  observed  using  the  development  board. 

1  INTRODUCTION 

Prediction  techniques  have  become  important  because 
electromagnetic  radiation  can  damage  and/or  alter  the 
peformance  of  electronic  circuits  [1].  While  it  has 
been  shown  that  high  power  can  damage  electronic 
systems,  upsets  may  be  more  likely  to  occur,  and  are 
important  to  understand.  Upsets  or  intermittent 
problems  to  a  microcomputer  can  lead  to  invalid 
instructions  and  change  the  system’s  function.  Digital 
systems  tend  to  recover  on  their  own  but  the  delay  in 
time  is  an  issue.  While  most  digital  circuits  are 
immune  to  noise,  electromagnetic  pulses  can  lead  to 
timing  issues  for  clocked  digital  circuits. 

This  paper  studies  the  susceptibility  of  8051-based 
microcontrollers  mounted  on  a  standard  development 
board  and  a  custom  board  designed  specifically  for 
direct  power  injection  testing.  Development  boards 
are  made  to  be  versatile  by  supporting  numerous 
package  pinouts,  easy  programming,  multiple  displays, 
and  different  system  configurations.  As  a  result, 
routing  on  this  type  of  board  is  dense  and  can  impact 
the  amount  of  energy  injected  on  the  signal  of  interest. 
In  addition,  coupling  to  other  components  becomes  an 
issue  in  this  test  configuration.  Custom  board  design 
allows  for  better  control  of  the  power  injected  on  the 
microcontroller  but  places  the  system  in  isolation. 
Digital  electronics  will  inevitably  reside  within  a  larger 
system  and  while  effects  tests  for  an  individual 
microcontroller  are  important,  modeling  effects  in  an 
environment  similar  to  final  placement  is  important. 
This  study  will  be  used  to  model  how  test  board  type, 
injected  power,  pulse  width,  and  frequency  affect  the 
instruction  set  of  an  8051 -type  microcontroller. 

2  EXPERIMENT 

The  MikroElectronika  development  board  shown  in 
Fig.  1  is  267  mm  by  216  mm  and  is  a  fully  contained 


system  used  for  programming  Atmel  8051 
microcontrollers  [2].  It  is  attached  to  the 
microcontroller  using  a  mount  configured  for  a  20 
pin  dual  in-line  package  (DIP).  RF  power  is  injected 
into  the  IC  using  a  coaxial  cable  that  has  been 
modified  to  function  as  a  probe  [3]. 


The  custom  board  shown  in  Fig.  2  is  76.2  mm  by 
76.2  mm  and  uses  a  50Q  feed  that  connects  directly 
to  the  clock  pin.  The  design  is  based  on  the  IEC 
62132-4  documentation  [4].  The  board  material  is 
0.787  mm-thick  FR4  with  relative  permittivity  of  4.2 
and  loss  tangent  of  0.02. 


Figure  2:  Custom  board. 
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Similar  to  [5],  a  8051  microcontroller  has  been 
subjected  to  time-controlled  RF  pulses  where  a  set  of 
instructions  have  been  implemented.  The  upset  can 
be  tied  to  an  assembly  language  instruction  for  more 
fundamental  understanding  and  model  development. 
The  Atmel  AT89LP2052,  8-bit  microcontroller  has 
been  programmed  to  complete  a  binary  count  from  2° 
to  28.  A  20  pin  SOIC  has  been  assembled  on  the 
custom  board  with  dedicated  RF  feeds  to  the  clock, 
VCC  and  ground.  Fig.  3  shows  a  block  diagram  of 
the  experimental  set  up  for  direct  injection. 
Assuming  no  performance  changes,  the 
microcontroller  is  either  mounted  for  test  using  the 
development  board  (DIP)  or  soldered  onto  the 
custom  board  (SOIC).  Lab  VIEW  has  been  used  to 
control  the  power  level  and  timing  of  the  RF  source 
(MXG),  and  data  acquisition  using  the  oscilloscope. 
An  external  amplifier  is  not  used  as  this  study  is  to 
understand  upset  or  timing  shifts  and  not  failure  to 
the  LP2052. 


Figure  3:  Test  set  up  for  direct  injection. 

The  RF  pulse  has  been  injected  onto  the 
microcontroller  based  on  a  complete  1  ps  clock  cycle 
(target  location  1)  during  a  no  operation  (NOP) 
instruction.  Shorter  clock  cycles  have  been  divided 
into  0.24  ps  segments  and  are  described  in  Table  1. 
Pulse  widths  shorter  than  0.24  ps  could  not  be 
achieved  using  the  MXG.  A  20  dB  bi-directional 
coupler  is  used  to  monitor  power  input  to  the 
microcontroller. 


Table  1:  Target  location  description  and  time. 


Target  Location 

Pulse 
width  (ps) 

ID 

Complete  clock  cycle 

1 

TL1 

Logic  high 

0.48 

TL3 

1st  V2  logic  high 

0.24 

TL4 

2nd  V2  logic  high 

0.24 

TL5 

Logic  low 

0.48 

TL7 

1st  V2  logic  low 

0.24 

TL8 

2nd  V2  logic  low 

0.24 

TL9 

An  initial  experiment  was  conducted  where  frequency 
was  varied  between  50  and  100  MHz  and  MXG  ower 
was  swept  from  5  to  17  dBm,  using  both  boards 
(Table  2).  For  each  power  level  and  frequency,  100 
shots  were  injected  at  the  7  target  locations.  Using 
Lab  VIEW  the  data  collection  takes  up  to  6  hours  for 
14000  shots.  An  additional  program  is  used  to 
process  and  analyze  the  data,  taking  up  to  2  hours. 


Table  2:  Initial  RF  injection  test  on  both  boards. 


Board 

Demo 

Custom 

f  (MHz),  in  5  MHz  steps 

50-100 

50-90 

#  of  shots 

100 

Power  level  (dBm),  in 
0.12  dB  steps 

5  -  17 

Target  locations 

1,3,4,  5,7,  8,9 

Total  #  of  RF  injections 

7700 

6300 

Data  collection 

5-6  hours 

An  upset  is  equivalent  to  a  change  in  the  P  1.1  output 
pin  of  the  microcontroller.  In  the  counter  algorithm, 
this  is  the  2nd  least  significant  bit.  The  data  is  collected 
using  an  oscilloscope  and  converted  to  binary.  It  is 
then  compared  with  a  previously  stored  reference 
waveform.  Each  bit  in  a  90  ps  observation  window  is 
compared  and  if  different,  adds  to  an  error  counter.  An 
upset  is  achieved  when  the  counter  reaches  a 
predefined  number  associated  with  the  window.  The 
DG535  resets  the  microcontroller  after  each 
experiment.  Fig.  4  shows  a  photograph  of  the  test. 

In  both  boards,  the  shortest  pulse  widths  (0.24  ps)  did 
not  produce  upsets,  namely  TLs  5,  8  and  9.  However, 
TL  4  did  experience  an  upset  and  corresponds  to  the  1st 
half  of  the  clock  cycle.  Focused  experiments  were 
conducted  on  TL  1,  3,  4  and  7  as  shown  in  Table  3, 
where  the  power  range  was  modified  to  10  -  17  dBm 
and  the  number  of  shots  was  increased  to  200. 


Table  3:  Focused  RF  injection  test  on  both  boards. 


Board 

Demo 

Custom 

/  (MHz),  in  5  MHz  steps 

50-100 

#  of  shots 

200 

Power  level  (dBm) 

10  -  17 

Target  locations 

1,3, 4, 7 

Total  #  of  RF  injections 

6600 

8800 

Figure  4:  Photograph  of  experiment. 
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3  RESULTS 

The  focused  experiment  results  have  been  processed 
to  compare  how  the  board  impacts  upsets.  TL  1 
experienced  an  upset  throughout  the  entire  frequency 
range  studied.  It  encompasses  a  complete  clock  cycle 
and  has  the  greatest  vulnerability.  Fig.  5  shows  the 
coupled  port  voltage  where  the  first  upset  occurs  for 
TL  1.  The  custom  board  requires  0.02  V  less  to 
realize  an  upset  compared  to  the  development  board 
with  mount.  The  actual  input  voltage  to  the 
microcontroller  is  an  order  of  magnitude  greater  than 
what  is  plotted  due  to  the  20  dB  coupled  port. 


Figure  5:  TL  1  output  power  for  both  boards. 

At  50  MHz,  the  custom  board  requires  more  voltage 
to  generate  an  upset  and  this  is  observed  for  TL  1,  3 
and  7.  Beyond  60  MHz,  TL  4  did  not  have  an  upset 
on  the  development  board  whereas  it  did  on  the 
custom  board.  This  indicates  that  the  custom  board 
can  be  sensitive  to  narrow  width  pulses. 

Fig.  6  shows  a  plot  of  the  input  impedance  up  to  250 
MHz  for  both  boards.  A  8.5  GHz  Agilent  VNA  has 
been  connected  to  the  directional  coupler  and  the 
clock  pin  of  the  microcontroller  (clock  not  in 
operation).  This  gives  an  idea  of  the  input 
impedance  the  MXG  source  sees  to  determine  how 
much  voltage  is  being  reflected  at  the  injection  pin. 
The  calibrated  one -port  reflection  coefficient  (shown 
as  return  loss  (RL)  indicates  that  most  of  the  power 
input  to  the  clock  pin  on  the  custom  board  will  be 
rejected  except  at  54  MHz.  Similarly  the  mount 
shows  two  frequencies  where  RL  is  better  than  15 
dB,  at  83  and  148  MHz.  At  227  MHz  both  boards 
have  a  reflection  dip  indicating  a  match  to  the  system 
and  therefore  an  ability  to  inject  voltage  with  little 
reflection. 


Figure  6:  Clock  pin  RL  (dB)  for  both  boards. 

4  CONCLUSIONS 

A  8051 -type  microcontroller  has  been  tested  in  two 
environments,  one  on  a  versatile  development  board 
and  the  other  on  a  custom  designed  RF  injection  board. 
The  input  impedance  of  both  boards  differ  which  may 
imply  that  more  power  is  needed  to  generate  upsets  in 
order  to  overcome  the  impedance  mismatch.  Within 
the  60  to  100  MHz  range,  the  custom  board  requires 
less  voltage  to  generate  an  upset,  while  at  50  MHz,  the 
mount  requires  less  voltage.  This  data  is  useful  to 
understand  how  board  design  can  be  used  in  modeling 
microcontroller  upset  as  a  function  of  controlled  pulse 
widths. 
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